From 3343e653da572f366836b3f791402eed191a1387 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexander=20Lindesk=C3=A4r?= Date: Thu, 24 Sep 2026 11:44:03 +0200 Subject: [PATCH 1/2] feat(helm): default global.images.envoyProxy.image to DefaultEnvoyProxyImage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Source the gateway-helm envoyProxy image default from the DefaultEnvoyProxyImage constant at chart generation time, so the Envoy image appears in rendered manifests and cannot drift from the controller default. Inline config.envoyGateway.envoyProxy settings now take precedence over the global image, and an inline envoyDaemonSet receives the image instead of an extra envoyDeployment. Fixes #9144 Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Alexander Lindeskär --- charts/gateway-helm/README.md | 2 +- charts/gateway-helm/templates/_helpers.tpl | 26 +- charts/gateway-helm/values.tmpl.yaml | 7 +- .../9144-helm-default-envoy-proxy-image.md | 1 + .../9144-helm-default-envoy-proxy-image.md | 1 + site/content/en/community/RELEASING.md | 9 +- .../en/latest/install/gateway-helm-api.md | 2 +- .../gateway-helm/certgen-annotations.out.yaml | 7 + test/helm/gateway-helm/certgen-args.out.yaml | 7 + .../helm/gateway-helm/certgen-labels.out.yaml | 7 + .../certgen-pod-securitycontext.out.yaml | 7 + .../certjen-custom-scheduling.out.yaml | 7 + test/helm/gateway-helm/common-labels.out.yaml | 7 + .../control-plane-with-pdb.out.yaml | 7 + .../helm/gateway-helm/default-config.out.yaml | 7 + .../deployment-annotations.out.yaml | 7 + .../deployment-custom-topology.out.yaml | 7 + .../gateway-helm/deployment-extraenv.out.yaml | 7 + .../deployment-images-config.out.yaml | 7 + .../deployment-pod-securitycontext.out.yaml | 7 + .../deployment-priorityclass.out.yaml | 7 + .../deployment-repo-no-registry.out.yaml | 7 + .../deployment-securitycontext.out.yaml | 7 + .../gateway-helm/deployment-strategy.out.yaml | 7 + .../deployment-volume-mounts.out.yaml | 7 + .../deployment-wasm-cache-volume.out.yaml | 7 + .../envoy-gateway-config.out.yaml | 7 + ...ay-gateway-namespace-config-watch.out.yaml | 7 + ...-gateway-gateway-namespace-config.out.yaml | 7 + ...teway-namespace-namespaceselector.out.yaml | 7 + .../envoy-proxy-daemonset.in.yaml | 16 + .../envoy-proxy-daemonset.out.yaml | 833 +++++++++++++++++ .../envoy-proxy-image-disabled.in.yaml | 7 + .../envoy-proxy-image-disabled.out.yaml | 823 +++++++++++++++++ .../envoy-proxy-inline-image.in.yaml | 18 + .../envoy-proxy-inline-image.out.yaml | 835 ++++++++++++++++++ ...l-pullsecrets-override-deployment.out.yaml | 11 + ...lobal-pullsecrets-override-global.out.yaml | 11 + ...obal-registry-override-deployment.out.yaml | 7 + .../global-registry-override-global.out.yaml | 7 + ...orizontal-pod-autoscaler-disabled.out.yaml | 7 + .../horizontal-pod-autoscaler.out.yaml | 7 + .../gateway-helm/namespace-override.out.yaml | 7 + .../safe-upgrade-policy-disabled.out.yaml | 7 + .../service-customization.out.yaml | 7 + .../gateway-helm/webhook-disabled.out.yaml | 7 + tools/make/docs.mk | 2 +- tools/make/env.mk | 3 + tools/make/helm.mk | 2 +- 49 files changed, 2805 insertions(+), 21 deletions(-) create mode 100644 release-notes/current/breaking_changes/9144-helm-default-envoy-proxy-image.md create mode 100644 release-notes/current/new_features/9144-helm-default-envoy-proxy-image.md create mode 100644 test/helm/gateway-helm/envoy-proxy-daemonset.in.yaml create mode 100644 test/helm/gateway-helm/envoy-proxy-daemonset.out.yaml create mode 100644 test/helm/gateway-helm/envoy-proxy-image-disabled.in.yaml create mode 100644 test/helm/gateway-helm/envoy-proxy-image-disabled.out.yaml create mode 100644 test/helm/gateway-helm/envoy-proxy-inline-image.in.yaml create mode 100644 test/helm/gateway-helm/envoy-proxy-inline-image.out.yaml diff --git a/charts/gateway-helm/README.md b/charts/gateway-helm/README.md index 2889e94b97d..a61107bd827 100644 --- a/charts/gateway-helm/README.md +++ b/charts/gateway-helm/README.md @@ -163,7 +163,7 @@ helm uninstall eg -n envoy-gateway-system | global.images.envoyGateway.image | string | `nil` | Full image for the Envoy Gateway control plane Deployment installed by this chart. | | global.images.envoyGateway.pullPolicy | string | `nil` | Image pull policy for the Envoy Gateway control plane Deployment. Default behavior: latest images will be Always else IfNotPresent. | | global.images.envoyGateway.pullSecrets | list | `[]` | Pull secrets for the Envoy Gateway control plane Deployment. | -| global.images.envoyProxy.image | string | `""` | Full image for the managed Envoy Proxy data plane. This updates the generated `envoyProxy` config and does not change the `envoy-gateway` control plane Deployment image. If not specified, the default image built into `envoy-gateway` is used. | +| global.images.envoyProxy.image | string | `"docker.io/envoyproxy/envoy:distroless-dev"` | Full image for the managed Envoy Proxy data plane. This updates the generated `envoyProxy` config and does not change the `envoy-gateway` control plane Deployment image. Defaults to the Envoy Proxy image this Envoy Gateway release is built for. An image set inline under `config.envoyGateway.envoyProxy` takes precedence. Set to `""` to omit it and fall back to the default image built into `envoy-gateway`. | | global.images.envoyProxy.pullPolicy | string | `""` | Image pull policy for the managed Envoy Proxy data plane. Default behavior: IfNotPresent. | | global.images.envoyProxy.pullSecrets | list | `[]` | Pull secrets for the managed Envoy Proxy data plane. | | global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` | | diff --git a/charts/gateway-helm/templates/_helpers.tpl b/charts/gateway-helm/templates/_helpers.tpl index d289700bd5f..85e59c95ba6 100755 --- a/charts/gateway-helm/templates/_helpers.tpl +++ b/charts/gateway-helm/templates/_helpers.tpl @@ -189,29 +189,33 @@ imagePullSecrets: {{ toYaml list }} {{/* The default Envoy Gateway configuration. +The envoy-gateway-config ConfigMap merges .Values.config.envoyGateway over this, so inline +settings (such as an Envoy Proxy image under config.envoyGateway.envoyProxy) take precedence. */}} {{- define "eg.default-envoy-gateway-config" -}} -{{- if or .Values.global.images.envoyProxy.image .Values.config.envoyGateway.envoyProxy }} -{{- $envoyProxyBase := .Values.config.envoyGateway.envoyProxy | default dict }} -{{- $imageOverride := dict }} {{- if .Values.global.images.envoyProxy.image }} {{- $container := dict "image" (include "eg.envoyProxy.image" .) }} {{- if .Values.global.images.envoyProxy.pullPolicy }} {{- $_ := set $container "imagePullPolicy" .Values.global.images.envoyProxy.pullPolicy }} {{- end }} - {{- $deployment := dict "container" $container }} + {{- $workload := dict "container" $container }} {{- if or .Values.global.imagePullSecrets .Values.global.images.envoyProxy.pullSecrets }} {{- $pullSecretsYaml := include "eg.envoyProxy.image.pullSecrets" . }} {{- $pullSecrets := dict "imagePullSecrets" ($pullSecretsYaml | fromYaml).imagePullSecrets }} - {{- $_ := set $deployment "pod" $pullSecrets }} + {{- $_ := set $workload "pod" $pullSecrets }} + {{- end }} + {{- /* Target the workload kind the user configured; envoyDeployment and envoyDaemonSet are mutually exclusive. */}} + {{- $workloadKind := "envoyDeployment" }} + {{- $userKubernetes := dig "provider" "kubernetes" dict (.Values.config.envoyGateway.envoyProxy | default dict) }} + {{- if hasKey ($userKubernetes | default dict) "envoyDaemonSet" }} + {{- $workloadKind = "envoyDaemonSet" }} {{- end }} - {{- $kubernetes := dict "envoyDeployment" $deployment }} - {{- $provider := dict "type" "Kubernetes" "kubernetes" $kubernetes }} - {{- $imageOverride = dict "provider" $provider }} -{{- end }} -{{- $merged := mustMergeOverwrite (dict) $envoyProxyBase $imageOverride }} envoyProxy: -{{ toYaml $merged | indent 2 }} + provider: + type: Kubernetes + kubernetes: + {{ $workloadKind }}: + {{- toYaml $workload | nindent 8 }} {{- end }} provider: type: Kubernetes diff --git a/charts/gateway-helm/values.tmpl.yaml b/charts/gateway-helm/values.tmpl.yaml index 8609e2e20a7..c6bd188b701 100644 --- a/charts/gateway-helm/values.tmpl.yaml +++ b/charts/gateway-helm/values.tmpl.yaml @@ -28,9 +28,10 @@ global: envoyProxy: # -- Full image for the managed Envoy Proxy data plane. # This updates the generated `envoyProxy` config and does not change the `envoy-gateway` - # control plane Deployment image. If not specified, the default image built into - # `envoy-gateway` is used. - image: "" + # control plane Deployment image. Defaults to the Envoy Proxy image this Envoy Gateway + # release is built for. An image set inline under `config.envoyGateway.envoyProxy` takes + # precedence. Set to `""` to omit it and fall back to the default image built into `envoy-gateway`. + image: ${EnvoyProxyImage} # -- Image pull policy for the managed Envoy Proxy data plane. # Default behavior: IfNotPresent. pullPolicy: "" diff --git a/release-notes/current/breaking_changes/9144-helm-default-envoy-proxy-image.md b/release-notes/current/breaking_changes/9144-helm-default-envoy-proxy-image.md new file mode 100644 index 00000000000..9955c99633f --- /dev/null +++ b/release-notes/current/breaking_changes/9144-helm-default-envoy-proxy-image.md @@ -0,0 +1 @@ +Because the gateway-helm chart now sets a default `global.images.envoyProxy.image`, `global.imageRegistry` and `global.imagePullSecrets` also apply to the managed Envoy Proxy image; mirror the Envoy Proxy image into that registry before upgrading, or set `global.images.envoyProxy.image: ""` to keep the previous behavior. diff --git a/release-notes/current/new_features/9144-helm-default-envoy-proxy-image.md b/release-notes/current/new_features/9144-helm-default-envoy-proxy-image.md new file mode 100644 index 00000000000..7097427639d --- /dev/null +++ b/release-notes/current/new_features/9144-helm-default-envoy-proxy-image.md @@ -0,0 +1 @@ +The gateway-helm chart now defaults `global.images.envoyProxy.image` to the Envoy Proxy image the release is built for, so the image appears in rendered manifests for image mirroring and air-gapped tooling; an image set inline under `config.envoyGateway.envoyProxy` now takes precedence over `global.images.envoyProxy.image`, matching the ratelimit and control plane images, and an inline `envoyDaemonSet` receives the global image instead of an extra `envoyDeployment`. diff --git a/site/content/en/community/RELEASING.md b/site/content/en/community/RELEASING.md index 9d8ed4ac482..6e93580c794 100644 --- a/site/content/en/community/RELEASING.md +++ b/site/content/en/community/RELEASING.md @@ -63,7 +63,8 @@ export GITHUB_REMOTE=origin ``` 9. Create a topic branch for updating the [Envoy proxy image][] and [Envoy Ratelimit image][] to the tag supported by the release. - Please note that the tags should be updated in both the source code and the Helm chart. Reference [PR #5872][] + Please note that the tags should be updated in both the source code and the Helm chart. The Helm chart's + `global.images.envoyProxy.image` default is derived from `DefaultEnvoyProxyImage`, so run `make helm-generate helm-template` to refresh the Helm test outputs. Reference [PR #5872][] for additional details on updating the image tag. (+v1.8.x only) After updating the Envoy proxy image tag, update the dynamic module SDK and example dependencies: @@ -217,7 +218,8 @@ export GITHUB_REMOTE=origin 9. If upstream has updated the [Envoy proxy image][] or [Envoy Ratelimit image][] tag supported by the release, you should also create a topic branch for bumping these tags. - Please note that the tags should be updated in both the source code and the Helm chart. Reference [PR #5872][] + Please note that the tags should be updated in both the source code and the Helm chart. The Helm chart's + `global.images.envoyProxy.image` default is derived from `DefaultEnvoyProxyImage`, so run `make helm-generate helm-template` to refresh the Helm test outputs. Reference [PR #5872][] 8. Tag the head of your release branch with the release tag. For example: @@ -376,7 +378,8 @@ export GITHUB_REMOTE=origin 9. If upstream has updated the [Envoy proxy image][] or [Envoy Ratelimit image][] tag supported by the release, you should also create a topic branch for bumping these tags. - Please note that the tags should be updated in both the source code and the Helm chart. Reference [PR #5872][] + Please note that the tags should be updated in both the source code and the Helm chart. The Helm chart's + `global.images.envoyProxy.image` default is derived from `DefaultEnvoyProxyImage`, so run `make helm-generate helm-template` to refresh the Helm test outputs. Reference [PR #5872][] 9. Tag the head of your release branch with the release tag. For example: diff --git a/site/content/en/latest/install/gateway-helm-api.md b/site/content/en/latest/install/gateway-helm-api.md index 899556db0f7..dc117a7d54e 100644 --- a/site/content/en/latest/install/gateway-helm-api.md +++ b/site/content/en/latest/install/gateway-helm-api.md @@ -102,7 +102,7 @@ The Helm chart for Envoy Gateway | global.images.envoyGateway.image | string | `nil` | Full image for the Envoy Gateway control plane Deployment installed by this chart. | | global.images.envoyGateway.pullPolicy | string | `nil` | Image pull policy for the Envoy Gateway control plane Deployment. Default behavior: latest images will be Always else IfNotPresent. | | global.images.envoyGateway.pullSecrets | list | `[]` | Pull secrets for the Envoy Gateway control plane Deployment. | -| global.images.envoyProxy.image | string | `""` | Full image for the managed Envoy Proxy data plane. This updates the generated `envoyProxy` config and does not change the `envoy-gateway` control plane Deployment image. If not specified, the default image built into `envoy-gateway` is used. | +| global.images.envoyProxy.image | string | `"docker.io/envoyproxy/envoy:distroless-dev"` | Full image for the managed Envoy Proxy data plane. This updates the generated `envoyProxy` config and does not change the `envoy-gateway` control plane Deployment image. Defaults to the Envoy Proxy image this Envoy Gateway release is built for. An image set inline under `config.envoyGateway.envoyProxy` takes precedence. Set to `""` to omit it and fall back to the default image built into `envoy-gateway`. | | global.images.envoyProxy.pullPolicy | string | `""` | Image pull policy for the managed Envoy Proxy data plane. Default behavior: IfNotPresent. | | global.images.envoyProxy.pullSecrets | list | `[]` | Pull secrets for the managed Envoy Proxy data plane. | | global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` | | diff --git a/test/helm/gateway-helm/certgen-annotations.out.yaml b/test/helm/gateway-helm/certgen-annotations.out.yaml index fe4f5145184..97c19bce5f5 100644 --- a/test/helm/gateway-helm/certgen-annotations.out.yaml +++ b/test/helm/gateway-helm/certgen-annotations.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/certgen-args.out.yaml b/test/helm/gateway-helm/certgen-args.out.yaml index 12dcc8eb4ce..a684c63ca34 100644 --- a/test/helm/gateway-helm/certgen-args.out.yaml +++ b/test/helm/gateway-helm/certgen-args.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/certgen-labels.out.yaml b/test/helm/gateway-helm/certgen-labels.out.yaml index 8807b46d8a4..26fa6235599 100644 --- a/test/helm/gateway-helm/certgen-labels.out.yaml +++ b/test/helm/gateway-helm/certgen-labels.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/certgen-pod-securitycontext.out.yaml b/test/helm/gateway-helm/certgen-pod-securitycontext.out.yaml index 3293d24fc72..a9a3a588025 100644 --- a/test/helm/gateway-helm/certgen-pod-securitycontext.out.yaml +++ b/test/helm/gateway-helm/certgen-pod-securitycontext.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml b/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml index 6a3bb8b5211..6d4cd92561c 100644 --- a/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml +++ b/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/common-labels.out.yaml b/test/helm/gateway-helm/common-labels.out.yaml index ed5faceddce..07f520f5ae6 100644 --- a/test/helm/gateway-helm/common-labels.out.yaml +++ b/test/helm/gateway-helm/common-labels.out.yaml @@ -40,6 +40,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/control-plane-with-pdb.out.yaml b/test/helm/gateway-helm/control-plane-with-pdb.out.yaml index 76bd3024150..1d248fffeb8 100644 --- a/test/helm/gateway-helm/control-plane-with-pdb.out.yaml +++ b/test/helm/gateway-helm/control-plane-with-pdb.out.yaml @@ -47,6 +47,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/default-config.out.yaml b/test/helm/gateway-helm/default-config.out.yaml index 3293d24fc72..a9a3a588025 100644 --- a/test/helm/gateway-helm/default-config.out.yaml +++ b/test/helm/gateway-helm/default-config.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-annotations.out.yaml b/test/helm/gateway-helm/deployment-annotations.out.yaml index 9d1ebc0cf00..599ef3d34b8 100644 --- a/test/helm/gateway-helm/deployment-annotations.out.yaml +++ b/test/helm/gateway-helm/deployment-annotations.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-custom-topology.out.yaml b/test/helm/gateway-helm/deployment-custom-topology.out.yaml index b7283a749e9..0248aa2fe39 100644 --- a/test/helm/gateway-helm/deployment-custom-topology.out.yaml +++ b/test/helm/gateway-helm/deployment-custom-topology.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-extraenv.out.yaml b/test/helm/gateway-helm/deployment-extraenv.out.yaml index a4eb3d0fae8..5d4d1cafa4f 100644 --- a/test/helm/gateway-helm/deployment-extraenv.out.yaml +++ b/test/helm/gateway-helm/deployment-extraenv.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-images-config.out.yaml b/test/helm/gateway-helm/deployment-images-config.out.yaml index 4b46dcabd1d..fba9d9cc6c6 100644 --- a/test/helm/gateway-helm/deployment-images-config.out.yaml +++ b/test/helm/gateway-helm/deployment-images-config.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-pod-securitycontext.out.yaml b/test/helm/gateway-helm/deployment-pod-securitycontext.out.yaml index 3293d24fc72..a9a3a588025 100644 --- a/test/helm/gateway-helm/deployment-pod-securitycontext.out.yaml +++ b/test/helm/gateway-helm/deployment-pod-securitycontext.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-priorityclass.out.yaml b/test/helm/gateway-helm/deployment-priorityclass.out.yaml index 9865d4780cf..aad2fe7831f 100644 --- a/test/helm/gateway-helm/deployment-priorityclass.out.yaml +++ b/test/helm/gateway-helm/deployment-priorityclass.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml b/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml index 5b941414fcf..1e17357684a 100644 --- a/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml +++ b/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-securitycontext.out.yaml b/test/helm/gateway-helm/deployment-securitycontext.out.yaml index a6c6192f4ec..d2ddad20bad 100644 --- a/test/helm/gateway-helm/deployment-securitycontext.out.yaml +++ b/test/helm/gateway-helm/deployment-securitycontext.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-strategy.out.yaml b/test/helm/gateway-helm/deployment-strategy.out.yaml index 9cdbb5f8f52..27fd00aa101 100644 --- a/test/helm/gateway-helm/deployment-strategy.out.yaml +++ b/test/helm/gateway-helm/deployment-strategy.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-volume-mounts.out.yaml b/test/helm/gateway-helm/deployment-volume-mounts.out.yaml index 6d4dd456fbc..c6ff11c71f6 100644 --- a/test/helm/gateway-helm/deployment-volume-mounts.out.yaml +++ b/test/helm/gateway-helm/deployment-volume-mounts.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/deployment-wasm-cache-volume.out.yaml b/test/helm/gateway-helm/deployment-wasm-cache-volume.out.yaml index 03a5b872a35..b56ebed0c21 100644 --- a/test/helm/gateway-helm/deployment-wasm-cache-volume.out.yaml +++ b/test/helm/gateway-helm/deployment-wasm-cache-volume.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/envoy-gateway-config.out.yaml b/test/helm/gateway-helm/envoy-gateway-config.out.yaml index 6b0f23cf154..e1f4c371e56 100644 --- a/test/helm/gateway-helm/envoy-gateway-config.out.yaml +++ b/test/helm/gateway-helm/envoy-gateway-config.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml index 687b82961b4..ec58c248b94 100644 --- a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml +++ b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml index 8288a9dd4c4..a0572e8802f 100644 --- a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml +++ b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml index 7e1d644f568..5c1d41c1167 100644 --- a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml +++ b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/envoy-proxy-daemonset.in.yaml b/test/helm/gateway-helm/envoy-proxy-daemonset.in.yaml new file mode 100644 index 00000000000..7c1dda5a367 --- /dev/null +++ b/test/helm/gateway-helm/envoy-proxy-daemonset.in.yaml @@ -0,0 +1,16 @@ +global: + images: + envoyGateway: + image: "docker.io/envoyproxy/gateway-dev:latest" + pullPolicy: Always + envoyProxy: + image: "private-hub/envoyproxy/envoy:dev" +config: + envoyGateway: + envoyProxy: + provider: + kubernetes: + envoyDaemonSet: + pod: + nodeSelector: + node-role: edge diff --git a/test/helm/gateway-helm/envoy-proxy-daemonset.out.yaml b/test/helm/gateway-helm/envoy-proxy-daemonset.out.yaml new file mode 100644 index 00000000000..dfc09737378 --- /dev/null +++ b/test/helm/gateway-helm/envoy-proxy-daemonset.out.yaml @@ -0,0 +1,833 @@ +--- +# Source: gateway-helm/templates/envoy-gateway-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +# Disable token automounting on the ServiceAccount by default to satisfy +# Kubescape control C-0034. Pods that need Kubernetes API access explicitly +# enable automountServiceAccountToken in their pod spec. +automountServiceAccountToken: false +metadata: + name: envoy-gateway + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +--- +# Source: gateway-helm/templates/envoy-gateway-config.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: envoy-gateway-config + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +data: + envoy-gateway.yaml: | + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDaemonSet: + container: + image: private-hub/envoyproxy/envoy:dev + pod: + nodeSelector: + node-role: edge + type: Kubernetes + extensionApis: {} + gateway: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + logging: + level: + default: info + provider: + kubernetes: + rateLimitDeployment: + container: + image: docker.io/envoyproxy/ratelimit:master + patch: + type: StrategicMerge + value: + spec: + template: + spec: + containers: + - imagePullPolicy: IfNotPresent + name: envoy-ratelimit + shutdownManager: + image: docker.io/envoyproxy/gateway-dev:latest + type: Kubernetes +--- +# Source: gateway-helm/templates/envoy-gateway-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: gateway-helm-envoy-gateway-role + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + - nodes + - namespaces + verbs: + - get + - list + - watch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gatewayclasses + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gatewayclasses/status + verbs: + - update +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceimports + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - configmaps + - secrets + - services + verbs: + - get + - list + - watch +- apiGroups: + - apps + resources: + - deployments + - daemonsets + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - gateway.envoyproxy.io + resources: + - envoyproxies + - envoypatchpolicies + - clienttrafficpolicies + - backendtrafficpolicies + - securitypolicies + - envoyextensionpolicies + - backends + - httproutefilters + verbs: + - get + - list + - watch +- apiGroups: + - gateway.envoyproxy.io + resources: + - envoyproxies/status + - envoypatchpolicies/status + - clienttrafficpolicies/status + - backendtrafficpolicies/status + - securitypolicies/status + - envoyextensionpolicies/status + - backends/status + verbs: + - update +- apiGroups: + - gateway.networking.k8s.io + resources: + - gateways + - listenersets + - grpcroutes + - httproutes + - referencegrants + - tcproutes + - tlsroutes + - udproutes + - backendtlspolicies + verbs: + - get + - list + - watch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gateways/status + - listenersets/status + - grpcroutes/status + - httproutes/status + - tcproutes/status + - tlsroutes/status + - udproutes/status + - backendtlspolicies/status + verbs: + - update +- apiGroups: + - "" + resources: + - pods + - pods/binding + verbs: + - get + - list + - patch + - update + - watch +--- +# Source: gateway-helm/templates/envoy-gateway-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: gateway-helm-envoy-gateway-rolebinding + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: gateway-helm-envoy-gateway-role +subjects: +- kind: ServiceAccount + name: 'envoy-gateway' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/infra-manager-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gateway-helm-infra-manager + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + - serviceaccounts + - services + - configmaps + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - apps + resources: + - deployments + - daemonsets + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - certificates.k8s.io + resources: + - clustertrustbundles + verbs: + - list + - get + - watch +--- +# Source: gateway-helm/templates/leader-election-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gateway-helm-leader-election-role + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +# Source: gateway-helm/templates/infra-manager-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gateway-helm-infra-manager + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: 'gateway-helm-infra-manager' +subjects: +- kind: ServiceAccount + name: 'envoy-gateway' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/leader-election-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gateway-helm-leader-election-rolebinding + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: 'gateway-helm-leader-election-role' +subjects: +- kind: ServiceAccount + name: 'envoy-gateway' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/envoy-gateway-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: envoy-gateway + namespace: envoy-gateway-system + labels: + control-plane: envoy-gateway + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + selector: + control-plane: envoy-gateway + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + ports: + - name: grpc + port: 18000 + targetPort: 18000 + - name: ratelimit + port: 18001 + targetPort: 18001 + - name: wasm + port: 18002 + targetPort: 18002 + - name: metrics + port: 19001 + targetPort: 19001 + - name: webhook + port: 9443 + targetPort: 9443 +--- +# Source: gateway-helm/templates/envoy-gateway-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: envoy-gateway + namespace: envoy-gateway-system + labels: + control-plane: envoy-gateway + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + control-plane: envoy-gateway + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + template: + metadata: + annotations: + prometheus.io/port: "19001" + prometheus.io/scrape: "true" + labels: + control-plane: envoy-gateway + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + spec: + automountServiceAccountToken: true + securityContext: + fsGroup: 65532 + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - args: + - server + - --config-path=/config/envoy-gateway.yaml + env: + - name: ENVOY_GATEWAY_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: KUBERNETES_CLUSTER_DOMAIN + value: cluster.local + image: docker.io/envoyproxy/gateway-dev:latest + imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 + name: envoy-gateway + ports: + - containerPort: 18000 + name: grpc + - containerPort: 18001 + name: ratelimit + - containerPort: 18002 + name: wasm + - containerPort: 19001 + name: metrics + - name: webhook + containerPort: 9443 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: + limits: + memory: 1024Mi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /config + name: envoy-gateway-config + readOnly: true + - mountPath: /certs + name: certs + readOnly: true + - mountPath: /var/lib/eg/wasm + name: wasm-cache + imagePullSecrets: [] + serviceAccountName: envoy-gateway + terminationGracePeriodSeconds: 10 + volumes: + - configMap: + defaultMode: 420 + name: envoy-gateway-config + name: envoy-gateway-config + - name: certs + secret: + secretName: envoy-gateway + # Writable cache for Wasm modules; required because the controller's + # root filesystem is read-only by default (readOnlyRootFilesystem). + - name: wasm-cache + emptyDir: {} +--- +# Source: gateway-helm/charts/crds/templates/gatewayapi-safe-upgrade-policy.yaml +# +# config/crd/experimental/gateway.networking.k8s.io_vap_safeupgrades.yaml +# +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + annotations: + gateway.networking.k8s.io/bundle-version: v1.6.1 + gateway.networking.k8s.io/channel: standard + name: "safe-upgrades.gateway.networking.k8s.io" +spec: + failurePolicy: Fail + matchConstraints: + resourceRules: + - apiGroups: ["apiextensions.k8s.io"] + apiVersions: ["v1"] + operations: ["CREATE", "UPDATE"] + resources: ["*"] + validations: + - expression: "object.spec.group != 'gateway.networking.k8s.io' || oldObject == null || ( + has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && + object.metadata.annotations['gateway.networking.k8s.io/channel'] == 'standard' ) || ( + oldObject != null && has(oldObject.metadata.annotations) && oldObject.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && + oldObject.metadata.annotations['gateway.networking.k8s.io/channel'] == 'experimental' )" + message: "Installing experimental CRDs on top of standard channel CRDs is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install experimental CRDs on top of standard channel CRDs." + reason: Invalid + - expression: | + object.spec.group != 'gateway.networking.k8s.io' || + (has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/bundle-version') && + (object.metadata.annotations['gateway.networking.k8s.io/bundle-version'] == 'v0.0.0-dev' || + (object.metadata.annotations['gateway.networking.k8s.io/bundle-version'].startsWith('v1.') && + !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], '^v1\\.[0-4](\\.|$)')))) + message: "Installing CRDs with version other than v0.0.0-dev or v1.5+ is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install other versions." + reason: Invalid +--- +# Source: gateway-helm/charts/crds/templates/gatewayapi-safe-upgrade-policy.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + annotations: + gateway.networking.k8s.io/bundle-version: v1.6.1 + gateway.networking.k8s.io/channel: standard + name: safe-upgrades.gateway.networking.k8s.io +spec: + policyName: safe-upgrades.gateway.networking.k8s.io + validationActions: [Deny] + matchResources: + resourceRules: + - apiGroups: ["apiextensions.k8s.io"] + apiVersions: ["v1"] + resources: ["customresourcedefinitions"] + operations: ["CREATE", "UPDATE"] +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +# Disable token automounting on the ServiceAccount by default to satisfy +# Kubescape control C-0034. Pods that need Kubernetes API access explicitly +# enable automountServiceAccountToken in their pod spec. +automountServiceAccountToken: false +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: 'gateway-helm-certgen:envoy-gateway-system' + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +rules: + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - get + - list + - watch + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + resourceNames: + - 'envoy-gateway-topology-injector.envoy-gateway-system' + verbs: + - update + - patch +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: 'gateway-helm-certgen:envoy-gateway-system' + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'gateway-helm-certgen:envoy-gateway-system' +subjects: + - kind: ServiceAccount + name: 'gateway-helm-certgen' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: 'gateway-helm-certgen' +subjects: +- kind: ServiceAccount + name: 'gateway-helm-certgen' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/certgen.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade +spec: + backoffLimit: 1 + completions: 1 + parallelism: 1 + template: + metadata: + labels: + app: certgen + spec: + automountServiceAccountToken: true + securityContext: + fsGroup: 65532 + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - command: + - envoy-gateway + - certgen + env: + - name: ENVOY_GATEWAY_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: KUBERNETES_CLUSTER_DOMAIN + value: cluster.local + image: docker.io/envoyproxy/gateway-dev:latest + imagePullPolicy: Always + name: envoy-gateway-certgen + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + imagePullSecrets: [] + restartPolicy: Never + serviceAccountName: gateway-helm-certgen + ttlSecondsAfterFinished: 30 +--- +# Source: gateway-helm/templates/envoy-proxy-topology-injector-webhook.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: 'envoy-gateway-topology-injector.envoy-gateway-system' + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" + labels: + app.kubernetes.io/component: topology-injector + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +webhooks: + - name: topology.webhook.gateway.envoyproxy.io + admissionReviewVersions: ["v1"] + sideEffects: None + clientConfig: + service: + name: envoy-gateway + namespace: envoy-gateway-system + path: "/inject-pod-topology" + port: 9443 + failurePolicy: Ignore + rules: + - operations: ["CREATE"] + apiGroups: [""] + apiVersions: ["v1"] + resources: ["pods/binding"] + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - envoy-gateway-system diff --git a/test/helm/gateway-helm/envoy-proxy-image-disabled.in.yaml b/test/helm/gateway-helm/envoy-proxy-image-disabled.in.yaml new file mode 100644 index 00000000000..799ae4b0e78 --- /dev/null +++ b/test/helm/gateway-helm/envoy-proxy-image-disabled.in.yaml @@ -0,0 +1,7 @@ +global: + images: + envoyGateway: + image: "docker.io/envoyproxy/gateway-dev:latest" + pullPolicy: Always + envoyProxy: + image: "" diff --git a/test/helm/gateway-helm/envoy-proxy-image-disabled.out.yaml b/test/helm/gateway-helm/envoy-proxy-image-disabled.out.yaml new file mode 100644 index 00000000000..3293d24fc72 --- /dev/null +++ b/test/helm/gateway-helm/envoy-proxy-image-disabled.out.yaml @@ -0,0 +1,823 @@ +--- +# Source: gateway-helm/templates/envoy-gateway-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +# Disable token automounting on the ServiceAccount by default to satisfy +# Kubescape control C-0034. Pods that need Kubernetes API access explicitly +# enable automountServiceAccountToken in their pod spec. +automountServiceAccountToken: false +metadata: + name: envoy-gateway + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +--- +# Source: gateway-helm/templates/envoy-gateway-config.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: envoy-gateway-config + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +data: + envoy-gateway.yaml: | + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyGateway + extensionApis: {} + gateway: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + logging: + level: + default: info + provider: + kubernetes: + rateLimitDeployment: + container: + image: docker.io/envoyproxy/ratelimit:master + patch: + type: StrategicMerge + value: + spec: + template: + spec: + containers: + - imagePullPolicy: IfNotPresent + name: envoy-ratelimit + shutdownManager: + image: docker.io/envoyproxy/gateway-dev:latest + type: Kubernetes +--- +# Source: gateway-helm/templates/envoy-gateway-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: gateway-helm-envoy-gateway-role + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + - nodes + - namespaces + verbs: + - get + - list + - watch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gatewayclasses + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gatewayclasses/status + verbs: + - update +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceimports + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - configmaps + - secrets + - services + verbs: + - get + - list + - watch +- apiGroups: + - apps + resources: + - deployments + - daemonsets + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - gateway.envoyproxy.io + resources: + - envoyproxies + - envoypatchpolicies + - clienttrafficpolicies + - backendtrafficpolicies + - securitypolicies + - envoyextensionpolicies + - backends + - httproutefilters + verbs: + - get + - list + - watch +- apiGroups: + - gateway.envoyproxy.io + resources: + - envoyproxies/status + - envoypatchpolicies/status + - clienttrafficpolicies/status + - backendtrafficpolicies/status + - securitypolicies/status + - envoyextensionpolicies/status + - backends/status + verbs: + - update +- apiGroups: + - gateway.networking.k8s.io + resources: + - gateways + - listenersets + - grpcroutes + - httproutes + - referencegrants + - tcproutes + - tlsroutes + - udproutes + - backendtlspolicies + verbs: + - get + - list + - watch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gateways/status + - listenersets/status + - grpcroutes/status + - httproutes/status + - tcproutes/status + - tlsroutes/status + - udproutes/status + - backendtlspolicies/status + verbs: + - update +- apiGroups: + - "" + resources: + - pods + - pods/binding + verbs: + - get + - list + - patch + - update + - watch +--- +# Source: gateway-helm/templates/envoy-gateway-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: gateway-helm-envoy-gateway-rolebinding + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: gateway-helm-envoy-gateway-role +subjects: +- kind: ServiceAccount + name: 'envoy-gateway' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/infra-manager-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gateway-helm-infra-manager + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + - serviceaccounts + - services + - configmaps + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - apps + resources: + - deployments + - daemonsets + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - certificates.k8s.io + resources: + - clustertrustbundles + verbs: + - list + - get + - watch +--- +# Source: gateway-helm/templates/leader-election-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gateway-helm-leader-election-role + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +# Source: gateway-helm/templates/infra-manager-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gateway-helm-infra-manager + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: 'gateway-helm-infra-manager' +subjects: +- kind: ServiceAccount + name: 'envoy-gateway' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/leader-election-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gateway-helm-leader-election-rolebinding + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: 'gateway-helm-leader-election-role' +subjects: +- kind: ServiceAccount + name: 'envoy-gateway' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/envoy-gateway-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: envoy-gateway + namespace: envoy-gateway-system + labels: + control-plane: envoy-gateway + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + selector: + control-plane: envoy-gateway + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + ports: + - name: grpc + port: 18000 + targetPort: 18000 + - name: ratelimit + port: 18001 + targetPort: 18001 + - name: wasm + port: 18002 + targetPort: 18002 + - name: metrics + port: 19001 + targetPort: 19001 + - name: webhook + port: 9443 + targetPort: 9443 +--- +# Source: gateway-helm/templates/envoy-gateway-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: envoy-gateway + namespace: envoy-gateway-system + labels: + control-plane: envoy-gateway + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + control-plane: envoy-gateway + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + template: + metadata: + annotations: + prometheus.io/port: "19001" + prometheus.io/scrape: "true" + labels: + control-plane: envoy-gateway + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + spec: + automountServiceAccountToken: true + securityContext: + fsGroup: 65532 + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - args: + - server + - --config-path=/config/envoy-gateway.yaml + env: + - name: ENVOY_GATEWAY_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: KUBERNETES_CLUSTER_DOMAIN + value: cluster.local + image: docker.io/envoyproxy/gateway-dev:latest + imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 + name: envoy-gateway + ports: + - containerPort: 18000 + name: grpc + - containerPort: 18001 + name: ratelimit + - containerPort: 18002 + name: wasm + - containerPort: 19001 + name: metrics + - name: webhook + containerPort: 9443 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: + limits: + memory: 1024Mi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /config + name: envoy-gateway-config + readOnly: true + - mountPath: /certs + name: certs + readOnly: true + - mountPath: /var/lib/eg/wasm + name: wasm-cache + imagePullSecrets: [] + serviceAccountName: envoy-gateway + terminationGracePeriodSeconds: 10 + volumes: + - configMap: + defaultMode: 420 + name: envoy-gateway-config + name: envoy-gateway-config + - name: certs + secret: + secretName: envoy-gateway + # Writable cache for Wasm modules; required because the controller's + # root filesystem is read-only by default (readOnlyRootFilesystem). + - name: wasm-cache + emptyDir: {} +--- +# Source: gateway-helm/charts/crds/templates/gatewayapi-safe-upgrade-policy.yaml +# +# config/crd/experimental/gateway.networking.k8s.io_vap_safeupgrades.yaml +# +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + annotations: + gateway.networking.k8s.io/bundle-version: v1.6.1 + gateway.networking.k8s.io/channel: standard + name: "safe-upgrades.gateway.networking.k8s.io" +spec: + failurePolicy: Fail + matchConstraints: + resourceRules: + - apiGroups: ["apiextensions.k8s.io"] + apiVersions: ["v1"] + operations: ["CREATE", "UPDATE"] + resources: ["*"] + validations: + - expression: "object.spec.group != 'gateway.networking.k8s.io' || oldObject == null || ( + has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && + object.metadata.annotations['gateway.networking.k8s.io/channel'] == 'standard' ) || ( + oldObject != null && has(oldObject.metadata.annotations) && oldObject.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && + oldObject.metadata.annotations['gateway.networking.k8s.io/channel'] == 'experimental' )" + message: "Installing experimental CRDs on top of standard channel CRDs is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install experimental CRDs on top of standard channel CRDs." + reason: Invalid + - expression: | + object.spec.group != 'gateway.networking.k8s.io' || + (has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/bundle-version') && + (object.metadata.annotations['gateway.networking.k8s.io/bundle-version'] == 'v0.0.0-dev' || + (object.metadata.annotations['gateway.networking.k8s.io/bundle-version'].startsWith('v1.') && + !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], '^v1\\.[0-4](\\.|$)')))) + message: "Installing CRDs with version other than v0.0.0-dev or v1.5+ is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install other versions." + reason: Invalid +--- +# Source: gateway-helm/charts/crds/templates/gatewayapi-safe-upgrade-policy.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + annotations: + gateway.networking.k8s.io/bundle-version: v1.6.1 + gateway.networking.k8s.io/channel: standard + name: safe-upgrades.gateway.networking.k8s.io +spec: + policyName: safe-upgrades.gateway.networking.k8s.io + validationActions: [Deny] + matchResources: + resourceRules: + - apiGroups: ["apiextensions.k8s.io"] + apiVersions: ["v1"] + resources: ["customresourcedefinitions"] + operations: ["CREATE", "UPDATE"] +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +# Disable token automounting on the ServiceAccount by default to satisfy +# Kubescape control C-0034. Pods that need Kubernetes API access explicitly +# enable automountServiceAccountToken in their pod spec. +automountServiceAccountToken: false +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: 'gateway-helm-certgen:envoy-gateway-system' + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +rules: + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - get + - list + - watch + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + resourceNames: + - 'envoy-gateway-topology-injector.envoy-gateway-system' + verbs: + - update + - patch +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: 'gateway-helm-certgen:envoy-gateway-system' + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'gateway-helm-certgen:envoy-gateway-system' +subjects: + - kind: ServiceAccount + name: 'gateway-helm-certgen' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: 'gateway-helm-certgen' +subjects: +- kind: ServiceAccount + name: 'gateway-helm-certgen' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/certgen.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade +spec: + backoffLimit: 1 + completions: 1 + parallelism: 1 + template: + metadata: + labels: + app: certgen + spec: + automountServiceAccountToken: true + securityContext: + fsGroup: 65532 + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - command: + - envoy-gateway + - certgen + env: + - name: ENVOY_GATEWAY_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: KUBERNETES_CLUSTER_DOMAIN + value: cluster.local + image: docker.io/envoyproxy/gateway-dev:latest + imagePullPolicy: Always + name: envoy-gateway-certgen + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + imagePullSecrets: [] + restartPolicy: Never + serviceAccountName: gateway-helm-certgen + ttlSecondsAfterFinished: 30 +--- +# Source: gateway-helm/templates/envoy-proxy-topology-injector-webhook.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: 'envoy-gateway-topology-injector.envoy-gateway-system' + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" + labels: + app.kubernetes.io/component: topology-injector + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +webhooks: + - name: topology.webhook.gateway.envoyproxy.io + admissionReviewVersions: ["v1"] + sideEffects: None + clientConfig: + service: + name: envoy-gateway + namespace: envoy-gateway-system + path: "/inject-pod-topology" + port: 9443 + failurePolicy: Ignore + rules: + - operations: ["CREATE"] + apiGroups: [""] + apiVersions: ["v1"] + resources: ["pods/binding"] + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - envoy-gateway-system diff --git a/test/helm/gateway-helm/envoy-proxy-inline-image.in.yaml b/test/helm/gateway-helm/envoy-proxy-inline-image.in.yaml new file mode 100644 index 00000000000..bad620581cd --- /dev/null +++ b/test/helm/gateway-helm/envoy-proxy-inline-image.in.yaml @@ -0,0 +1,18 @@ +global: + images: + envoyGateway: + image: "docker.io/envoyproxy/gateway-dev:latest" + pullPolicy: Always + envoyProxy: + pullPolicy: Always + pullSecrets: + - name: "secret1" +config: + envoyGateway: + envoyProxy: + provider: + kubernetes: + envoyDeployment: + replicas: 2 + container: + image: "private-hub/envoyproxy/envoy:custom" diff --git a/test/helm/gateway-helm/envoy-proxy-inline-image.out.yaml b/test/helm/gateway-helm/envoy-proxy-inline-image.out.yaml new file mode 100644 index 00000000000..9b497255f6c --- /dev/null +++ b/test/helm/gateway-helm/envoy-proxy-inline-image.out.yaml @@ -0,0 +1,835 @@ +--- +# Source: gateway-helm/templates/envoy-gateway-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +# Disable token automounting on the ServiceAccount by default to satisfy +# Kubescape control C-0034. Pods that need Kubernetes API access explicitly +# enable automountServiceAccountToken in their pod spec. +automountServiceAccountToken: false +metadata: + name: envoy-gateway + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +--- +# Source: gateway-helm/templates/envoy-gateway-config.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: envoy-gateway-config + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +data: + envoy-gateway.yaml: | + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: private-hub/envoyproxy/envoy:custom + imagePullPolicy: Always + pod: + imagePullSecrets: + - name: secret1 + replicas: 2 + type: Kubernetes + extensionApis: {} + gateway: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + logging: + level: + default: info + provider: + kubernetes: + rateLimitDeployment: + container: + image: docker.io/envoyproxy/ratelimit:master + patch: + type: StrategicMerge + value: + spec: + template: + spec: + containers: + - imagePullPolicy: IfNotPresent + name: envoy-ratelimit + shutdownManager: + image: docker.io/envoyproxy/gateway-dev:latest + type: Kubernetes +--- +# Source: gateway-helm/templates/envoy-gateway-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: gateway-helm-envoy-gateway-role + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + - nodes + - namespaces + verbs: + - get + - list + - watch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gatewayclasses + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gatewayclasses/status + verbs: + - update +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceimports + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - configmaps + - secrets + - services + verbs: + - get + - list + - watch +- apiGroups: + - apps + resources: + - deployments + - daemonsets + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - gateway.envoyproxy.io + resources: + - envoyproxies + - envoypatchpolicies + - clienttrafficpolicies + - backendtrafficpolicies + - securitypolicies + - envoyextensionpolicies + - backends + - httproutefilters + verbs: + - get + - list + - watch +- apiGroups: + - gateway.envoyproxy.io + resources: + - envoyproxies/status + - envoypatchpolicies/status + - clienttrafficpolicies/status + - backendtrafficpolicies/status + - securitypolicies/status + - envoyextensionpolicies/status + - backends/status + verbs: + - update +- apiGroups: + - gateway.networking.k8s.io + resources: + - gateways + - listenersets + - grpcroutes + - httproutes + - referencegrants + - tcproutes + - tlsroutes + - udproutes + - backendtlspolicies + verbs: + - get + - list + - watch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gateways/status + - listenersets/status + - grpcroutes/status + - httproutes/status + - tcproutes/status + - tlsroutes/status + - udproutes/status + - backendtlspolicies/status + verbs: + - update +- apiGroups: + - "" + resources: + - pods + - pods/binding + verbs: + - get + - list + - patch + - update + - watch +--- +# Source: gateway-helm/templates/envoy-gateway-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: gateway-helm-envoy-gateway-rolebinding + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: gateway-helm-envoy-gateway-role +subjects: +- kind: ServiceAccount + name: 'envoy-gateway' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/infra-manager-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gateway-helm-infra-manager + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + - serviceaccounts + - services + - configmaps + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - apps + resources: + - deployments + - daemonsets + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - get + - list + - delete + - deletecollection + - patch + - watch +- apiGroups: + - certificates.k8s.io + resources: + - clustertrustbundles + verbs: + - list + - get + - watch +--- +# Source: gateway-helm/templates/leader-election-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gateway-helm-leader-election-role + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +# Source: gateway-helm/templates/infra-manager-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gateway-helm-infra-manager + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: 'gateway-helm-infra-manager' +subjects: +- kind: ServiceAccount + name: 'envoy-gateway' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/leader-election-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gateway-helm-leader-election-rolebinding + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: 'gateway-helm-leader-election-role' +subjects: +- kind: ServiceAccount + name: 'envoy-gateway' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/envoy-gateway-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: envoy-gateway + namespace: envoy-gateway-system + labels: + control-plane: envoy-gateway + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + selector: + control-plane: envoy-gateway + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + ports: + - name: grpc + port: 18000 + targetPort: 18000 + - name: ratelimit + port: 18001 + targetPort: 18001 + - name: wasm + port: 18002 + targetPort: 18002 + - name: metrics + port: 19001 + targetPort: 19001 + - name: webhook + port: 9443 + targetPort: 9443 +--- +# Source: gateway-helm/templates/envoy-gateway-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: envoy-gateway + namespace: envoy-gateway-system + labels: + control-plane: envoy-gateway + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + control-plane: envoy-gateway + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + template: + metadata: + annotations: + prometheus.io/port: "19001" + prometheus.io/scrape: "true" + labels: + control-plane: envoy-gateway + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + spec: + automountServiceAccountToken: true + securityContext: + fsGroup: 65532 + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - args: + - server + - --config-path=/config/envoy-gateway.yaml + env: + - name: ENVOY_GATEWAY_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: KUBERNETES_CLUSTER_DOMAIN + value: cluster.local + image: docker.io/envoyproxy/gateway-dev:latest + imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 + name: envoy-gateway + ports: + - containerPort: 18000 + name: grpc + - containerPort: 18001 + name: ratelimit + - containerPort: 18002 + name: wasm + - containerPort: 19001 + name: metrics + - name: webhook + containerPort: 9443 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: + limits: + memory: 1024Mi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /config + name: envoy-gateway-config + readOnly: true + - mountPath: /certs + name: certs + readOnly: true + - mountPath: /var/lib/eg/wasm + name: wasm-cache + imagePullSecrets: [] + serviceAccountName: envoy-gateway + terminationGracePeriodSeconds: 10 + volumes: + - configMap: + defaultMode: 420 + name: envoy-gateway-config + name: envoy-gateway-config + - name: certs + secret: + secretName: envoy-gateway + # Writable cache for Wasm modules; required because the controller's + # root filesystem is read-only by default (readOnlyRootFilesystem). + - name: wasm-cache + emptyDir: {} +--- +# Source: gateway-helm/charts/crds/templates/gatewayapi-safe-upgrade-policy.yaml +# +# config/crd/experimental/gateway.networking.k8s.io_vap_safeupgrades.yaml +# +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + annotations: + gateway.networking.k8s.io/bundle-version: v1.6.1 + gateway.networking.k8s.io/channel: standard + name: "safe-upgrades.gateway.networking.k8s.io" +spec: + failurePolicy: Fail + matchConstraints: + resourceRules: + - apiGroups: ["apiextensions.k8s.io"] + apiVersions: ["v1"] + operations: ["CREATE", "UPDATE"] + resources: ["*"] + validations: + - expression: "object.spec.group != 'gateway.networking.k8s.io' || oldObject == null || ( + has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && + object.metadata.annotations['gateway.networking.k8s.io/channel'] == 'standard' ) || ( + oldObject != null && has(oldObject.metadata.annotations) && oldObject.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && + oldObject.metadata.annotations['gateway.networking.k8s.io/channel'] == 'experimental' )" + message: "Installing experimental CRDs on top of standard channel CRDs is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install experimental CRDs on top of standard channel CRDs." + reason: Invalid + - expression: | + object.spec.group != 'gateway.networking.k8s.io' || + (has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/bundle-version') && + (object.metadata.annotations['gateway.networking.k8s.io/bundle-version'] == 'v0.0.0-dev' || + (object.metadata.annotations['gateway.networking.k8s.io/bundle-version'].startsWith('v1.') && + !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], '^v1\\.[0-4](\\.|$)')))) + message: "Installing CRDs with version other than v0.0.0-dev or v1.5+ is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install other versions." + reason: Invalid +--- +# Source: gateway-helm/charts/crds/templates/gatewayapi-safe-upgrade-policy.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + annotations: + gateway.networking.k8s.io/bundle-version: v1.6.1 + gateway.networking.k8s.io/channel: standard + name: safe-upgrades.gateway.networking.k8s.io +spec: + policyName: safe-upgrades.gateway.networking.k8s.io + validationActions: [Deny] + matchResources: + resourceRules: + - apiGroups: ["apiextensions.k8s.io"] + apiVersions: ["v1"] + resources: ["customresourcedefinitions"] + operations: ["CREATE", "UPDATE"] +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +# Disable token automounting on the ServiceAccount by default to satisfy +# Kubescape control C-0034. Pods that need Kubernetes API access explicitly +# enable automountServiceAccountToken in their pod spec. +automountServiceAccountToken: false +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: 'gateway-helm-certgen:envoy-gateway-system' + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +rules: + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - get + - list + - watch + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + resourceNames: + - 'envoy-gateway-topology-injector.envoy-gateway-system' + verbs: + - update + - patch +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: 'gateway-helm-certgen:envoy-gateway-system' + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'gateway-helm-certgen:envoy-gateway-system' +subjects: + - kind: ServiceAccount + name: 'gateway-helm-certgen' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: gateway-helm/templates/certgen-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux. +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: 'gateway-helm-certgen' +subjects: +- kind: ServiceAccount + name: 'gateway-helm-certgen' + namespace: envoy-gateway-system +--- +# Source: gateway-helm/templates/certgen.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: gateway-helm-certgen + namespace: envoy-gateway-system + labels: + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": pre-install, pre-upgrade +spec: + backoffLimit: 1 + completions: 1 + parallelism: 1 + template: + metadata: + labels: + app: certgen + spec: + automountServiceAccountToken: true + securityContext: + fsGroup: 65532 + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - command: + - envoy-gateway + - certgen + env: + - name: ENVOY_GATEWAY_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: KUBERNETES_CLUSTER_DOMAIN + value: cluster.local + image: docker.io/envoyproxy/gateway-dev:latest + imagePullPolicy: Always + name: envoy-gateway-certgen + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + imagePullSecrets: [] + restartPolicy: Never + serviceAccountName: gateway-helm-certgen + ttlSecondsAfterFinished: 30 +--- +# Source: gateway-helm/templates/envoy-proxy-topology-injector-webhook.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: 'envoy-gateway-topology-injector.envoy-gateway-system' + annotations: + "helm.sh/hook": pre-install, pre-upgrade + "helm.sh/hook-weight": "-1" + labels: + app.kubernetes.io/component: topology-injector + helm.sh/chart: gateway-helm-v0.0.0-latest + app.kubernetes.io/name: gateway-helm + app.kubernetes.io/instance: gateway-helm + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +webhooks: + - name: topology.webhook.gateway.envoyproxy.io + admissionReviewVersions: ["v1"] + sideEffects: None + clientConfig: + service: + name: envoy-gateway + namespace: envoy-gateway-system + path: "/inject-pod-topology" + port: 9443 + failurePolicy: Ignore + rules: + - operations: ["CREATE"] + apiGroups: [""] + apiVersions: ["v1"] + resources: ["pods/binding"] + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - envoy-gateway-system diff --git a/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml b/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml index 0344bda7f87..03cc66cf87c 100644 --- a/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml +++ b/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml @@ -32,6 +32,17 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: private.registry/envoyproxy/envoy:distroless-dev + pod: + imagePullSecrets: + - key1: value1 + - key2: value2 + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml b/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml index ff2a15550aa..96692cf7536 100644 --- a/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml +++ b/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml @@ -32,6 +32,17 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: private.registry/envoyproxy/envoy:distroless-dev + pod: + imagePullSecrets: + - key1: value1 + - key2: value2 + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/global-registry-override-deployment.out.yaml b/test/helm/gateway-helm/global-registry-override-deployment.out.yaml index 7630eda1703..72f10383c62 100644 --- a/test/helm/gateway-helm/global-registry-override-deployment.out.yaml +++ b/test/helm/gateway-helm/global-registry-override-deployment.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: private.registry/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/global-registry-override-global.out.yaml b/test/helm/gateway-helm/global-registry-override-global.out.yaml index 3429ff21319..9920ead9721 100644 --- a/test/helm/gateway-helm/global-registry-override-global.out.yaml +++ b/test/helm/gateway-helm/global-registry-override-global.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: private.registry/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml b/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml index 0851221f80f..2122fd586c5 100644 --- a/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml +++ b/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml b/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml index 5ac5ed60e56..c48b81adb64 100644 --- a/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml +++ b/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/namespace-override.out.yaml b/test/helm/gateway-helm/namespace-override.out.yaml index 2bc9aa7f849..552fdc6f8e3 100644 --- a/test/helm/gateway-helm/namespace-override.out.yaml +++ b/test/helm/gateway-helm/namespace-override.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/safe-upgrade-policy-disabled.out.yaml b/test/helm/gateway-helm/safe-upgrade-policy-disabled.out.yaml index 6dff2afab59..ea1314ea3f6 100644 --- a/test/helm/gateway-helm/safe-upgrade-policy-disabled.out.yaml +++ b/test/helm/gateway-helm/safe-upgrade-policy-disabled.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/service-customization.out.yaml b/test/helm/gateway-helm/service-customization.out.yaml index 1b295ceeaff..110a72cbb81 100644 --- a/test/helm/gateway-helm/service-customization.out.yaml +++ b/test/helm/gateway-helm/service-customization.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/webhook-disabled.out.yaml b/test/helm/gateway-helm/webhook-disabled.out.yaml index 1d8043f0d95..a99822eb731 100644 --- a/test/helm/gateway-helm/webhook-disabled.out.yaml +++ b/test/helm/gateway-helm/webhook-disabled.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/tools/make/docs.mk b/tools/make/docs.mk index 9913c4fffef..9e1c8963ac6 100644 --- a/tools/make/docs.mk +++ b/tools/make/docs.mk @@ -129,7 +129,7 @@ helm-readme-gen.%: $(eval CHART_NAME := $(COMMAND)) # use production ENV to generate helm api doc @if test -f "charts/${CHART_NAME}/values.tmpl.yaml"; then \ - ImageRepository=docker.io/envoyproxy/gateway ImageTag=latest ImagePullPolicy=IfNotPresent \ + ImageRepository=docker.io/envoyproxy/gateway ImageTag=latest ImagePullPolicy=IfNotPresent EnvoyProxyImage=${ENVOY_PROXY_IMAGE} \ envsubst < charts/${CHART_NAME}/values.tmpl.yaml > ./charts/${CHART_NAME}/values.yaml; \ fi diff --git a/tools/make/env.mk b/tools/make/env.mk index 1e3d533259e..a109e0e4501 100644 --- a/tools/make/env.mk +++ b/tools/make/env.mk @@ -15,6 +15,9 @@ IMAGE_NAME ?= gateway-dev IMAGE ?= ${REGISTRY}/${IMAGE_NAME} # Tag is the tag to use for build and push image targets. TAG ?= $(REV) +# ENVOY_PROXY_IMAGE is the default Envoy proxy image rendered by the gateway-helm chart. +# It is sourced from DefaultEnvoyProxyImage so the chart and the controller never drift apart. +ENVOY_PROXY_IMAGE ?= $(shell grep -m1 'DefaultEnvoyProxyImage *=' api/v1alpha1/shared_types.go | cut -d '"' -f2) # Fuzzing variables diff --git a/tools/make/helm.mk b/tools/make/helm.mk index d339a0d1287..f3f4f3b52b7 100644 --- a/tools/make/helm.mk +++ b/tools/make/helm.mk @@ -52,7 +52,7 @@ helm-generate.%: $(eval COMMAND := $(word 1,$(subst ., ,$*))) $(eval CHART_NAME := $(COMMAND)) @if test -f "charts/${CHART_NAME}/values.tmpl.yaml"; then \ - GatewayImage=${IMAGE}:${TAG} GatewayImagePullPolicy=${IMAGE_PULL_POLICY} \ + GatewayImage=${IMAGE}:${TAG} GatewayImagePullPolicy=${IMAGE_PULL_POLICY} EnvoyProxyImage=${ENVOY_PROXY_IMAGE} \ envsubst < charts/${CHART_NAME}/values.tmpl.yaml > ./charts/${CHART_NAME}/values.yaml; \ fi $(GO_TOOL) helm dependency update charts/${CHART_NAME} From a600e79a7253a4c78015e9a70a751b735c70d7bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexander=20Lindesk=C3=A4r?= Date: Fri, 30 Oct 2026 13:24:16 +0100 Subject: [PATCH 2/2] fix(gatewayapi): convert the less specific Envoy workload kind when merging EnvoyProxy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 Signed-off-by: Alexander Lindeskär --- api/v1alpha1/envoyproxy_types.go | 5 + .../gateway.envoyproxy.io_envoyproxies.yaml | 5 + .../gateway.envoyproxy.io_envoyproxies.yaml | 5 + internal/gatewayapi/envoyproxy_merge.go | 52 ++++- internal/gatewayapi/envoyproxy_merge_test.go | 182 ++++++++++++++++++ .../10101-envoyproxy-merge-workload-kind.md | 1 + site/content/en/latest/api/extension_types.md | 2 +- test/helm/gateway-crds-helm/all.out.yaml | 5 + test/helm/gateway-crds-helm/e2e.out.yaml | 5 + .../envoy-gateway-crds.out.yaml | 5 + .../envoy-gateway-config-watch.out.yaml | 7 + .../envoy-proxy-daemonset.out.yaml | 7 + .../envoy-proxy-image-disabled.out.yaml | 7 + .../envoy-proxy-inline-image.out.yaml | 7 + 14 files changed, 293 insertions(+), 2 deletions(-) create mode 100644 release-notes/current/bug_fixes/10101-envoyproxy-merge-workload-kind.md diff --git a/api/v1alpha1/envoyproxy_types.go b/api/v1alpha1/envoyproxy_types.go index 3ccd419a5e2..c197cd8c08b 100644 --- a/api/v1alpha1/envoyproxy_types.go +++ b/api/v1alpha1/envoyproxy_types.go @@ -263,6 +263,11 @@ type EnvoyProxySpec struct { // MergeType controls how this EnvoyProxy merges with less specific configurations // in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway). // If unset, this EnvoyProxy completely replaces less specific settings. + // When merging, if this EnvoyProxy sets envoyDeployment or envoyDaemonSet and a less + // specific configuration sets the other, the less specific workload is converted to + // the selected kind: its container, pod and name settings are kept, and settings that + // only apply to the previous kind (including its patch, and envoyHpa when switching + // to envoyDaemonSet) are dropped. // Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. // +kubebuilder:validation:Enum=Replace;StrategicMerge;JSONMerge // +optional diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml index aa5730a47c8..cf42cfa9ff4 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml @@ -952,6 +952,11 @@ spec: MergeType controls how this EnvoyProxy merges with less specific configurations in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway). If unset, this EnvoyProxy completely replaces less specific settings. + When merging, if this EnvoyProxy sets envoyDeployment or envoyDaemonSet and a less + specific configuration sets the other, the less specific workload is converted to + the selected kind: its container, pod and name settings are kept, and settings that + only apply to the previous kind (including its patch, and envoyHpa when switching + to envoyDaemonSet) are dropped. Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. enum: - Replace diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml index 18b2851432d..b230daf628c 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml @@ -951,6 +951,11 @@ spec: MergeType controls how this EnvoyProxy merges with less specific configurations in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway). If unset, this EnvoyProxy completely replaces less specific settings. + When merging, if this EnvoyProxy sets envoyDeployment or envoyDaemonSet and a less + specific configuration sets the other, the less specific workload is converted to + the selected kind: its container, pod and name settings are kept, and settings that + only apply to the previous kind (including its patch, and envoyHpa when switching + to envoyDaemonSet) are dropped. Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. enum: - Replace diff --git a/internal/gatewayapi/envoyproxy_merge.go b/internal/gatewayapi/envoyproxy_merge.go index 53ab2d4f8b2..d828925311d 100644 --- a/internal/gatewayapi/envoyproxy_merge.go +++ b/internal/gatewayapi/envoyproxy_merge.go @@ -90,9 +90,59 @@ func mergeEnvoyProxies( return override, nil } - merged, err := utils.Merge(*base, *override, mergeType) + merged, err := utils.Merge(*alignWorkloadKind(base, override), *override, mergeType) if err != nil { return nil, err } return &merged, nil } + +// alignWorkloadKind returns base with its Envoy workload converted to the kind +// that override selects, so a merge never yields both an envoyDeployment and an +// envoyDaemonSet. The container, pod and name settings carry over to the new +// kind; settings that only apply to the previous kind are dropped, including +// its patch and, when switching to a DaemonSet, envoyHpa. +func alignWorkloadKind(base, override *egv1a1.EnvoyProxy) *egv1a1.EnvoyProxy { + baseKube, overrideKube := kubernetesProvider(base), kubernetesProvider(override) + if baseKube == nil || overrideKube == nil { + return base + } + + switch { + case overrideKube.EnvoyDaemonSet != nil && overrideKube.EnvoyDeployment == nil && baseKube.EnvoyDeployment != nil: + aligned := base.DeepCopy() + kube := aligned.Spec.Provider.Kubernetes + if kube.EnvoyDaemonSet == nil { + deployment := kube.EnvoyDeployment + kube.EnvoyDaemonSet = &egv1a1.KubernetesDaemonSetSpec{ + Pod: deployment.Pod, + Container: deployment.Container, + Name: deployment.Name, + } + } + kube.EnvoyDeployment = nil + kube.EnvoyHpa = nil + return aligned + case overrideKube.EnvoyDeployment != nil && overrideKube.EnvoyDaemonSet == nil && baseKube.EnvoyDaemonSet != nil: + aligned := base.DeepCopy() + kube := aligned.Spec.Provider.Kubernetes + if kube.EnvoyDeployment == nil { + daemonSet := kube.EnvoyDaemonSet + kube.EnvoyDeployment = &egv1a1.KubernetesDeploymentSpec{ + Pod: daemonSet.Pod, + Container: daemonSet.Container, + Name: daemonSet.Name, + } + } + kube.EnvoyDaemonSet = nil + return aligned + } + return base +} + +func kubernetesProvider(ep *egv1a1.EnvoyProxy) *egv1a1.EnvoyProxyKubernetesProvider { + if ep.Spec.Provider == nil { + return nil + } + return ep.Spec.Provider.Kubernetes +} diff --git a/internal/gatewayapi/envoyproxy_merge_test.go b/internal/gatewayapi/envoyproxy_merge_test.go index 7d63cb8310f..8443fb266aa 100644 --- a/internal/gatewayapi/envoyproxy_merge_test.go +++ b/internal/gatewayapi/envoyproxy_merge_test.go @@ -10,6 +10,7 @@ import ( "github.com/google/go-cmp/cmp" "github.com/stretchr/testify/require" + apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" gwapiv1 "sigs.k8s.io/gateway-api/apis/v1" egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1" @@ -375,6 +376,159 @@ func TestMergeEnvoyProxyConfigs(t *testing.T) { }, }, }, + { + name: "gatewayclass StrategicMerge daemonset - converts default deployment and drops its patch and hpa", + defaultSpec: &egv1a1.EnvoyProxySpec{ + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{ + Replicas: new(int32(2)), + Container: &egv1a1.KubernetesContainerSpec{Image: new("mirror.example/envoy:dev")}, + Patch: &egv1a1.KubernetesPatchSpec{ + Value: apiextensionsv1.JSON{Raw: []byte(`{"spec":{"replicas":3}}`)}, + }, + }, + EnvoyHpa: &egv1a1.KubernetesHorizontalPodAutoscalerSpec{MaxReplicas: new(int32(5))}, + }, + }, + }, + gatewayClassProxy: &egv1a1.EnvoyProxy{ + Spec: egv1a1.EnvoyProxySpec{ + MergeType: new(egv1a1.StrategicMerge), + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{ + Pod: &egv1a1.KubernetesPodSpec{NodeSelector: map[string]string{"role": "edge"}}, + }, + }, + }, + }, + }, + expectedSpec: &egv1a1.EnvoyProxySpec{ + MergeType: new(egv1a1.StrategicMerge), + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{ + Pod: &egv1a1.KubernetesPodSpec{NodeSelector: map[string]string{"role": "edge"}}, + Container: &egv1a1.KubernetesContainerSpec{Image: new("mirror.example/envoy:dev")}, + }, + }, + }, + }, + }, + { + name: "gatewayclass JSONMerge daemonset - converts default deployment", + defaultSpec: &egv1a1.EnvoyProxySpec{ + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{ + Container: &egv1a1.KubernetesContainerSpec{Image: new("mirror.example/envoy:dev")}, + }, + }, + }, + }, + gatewayClassProxy: &egv1a1.EnvoyProxy{ + Spec: egv1a1.EnvoyProxySpec{ + MergeType: new(egv1a1.JSONMerge), + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{}, + }, + }, + }, + }, + expectedSpec: &egv1a1.EnvoyProxySpec{ + MergeType: new(egv1a1.JSONMerge), + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{ + Container: &egv1a1.KubernetesContainerSpec{Image: new("mirror.example/envoy:dev")}, + }, + }, + }, + }, + }, + { + name: "gateway StrategicMerge deployment - converts default daemonset", + defaultSpec: &egv1a1.EnvoyProxySpec{ + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{ + Container: &egv1a1.KubernetesContainerSpec{Image: new("mirror.example/envoy:dev")}, + }, + }, + }, + }, + gatewayProxy: &egv1a1.EnvoyProxy{ + Spec: egv1a1.EnvoyProxySpec{ + MergeType: new(egv1a1.StrategicMerge), + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{Replicas: new(int32(3))}, + }, + }, + }, + }, + expectedSpec: &egv1a1.EnvoyProxySpec{ + MergeType: new(egv1a1.StrategicMerge), + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{ + Replicas: new(int32(3)), + Container: &egv1a1.KubernetesContainerSpec{Image: new("mirror.example/envoy:dev")}, + }, + }, + }, + }, + }, + { + name: "gateway StrategicMerge daemonset - converts gatewayclass deployment", + gatewayClassProxy: &egv1a1.EnvoyProxy{ + Spec: egv1a1.EnvoyProxySpec{ + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{ + Name: new("edge-proxy"), + Container: &egv1a1.KubernetesContainerSpec{Image: new("mirror.example/envoy:dev")}, + }, + }, + }, + }, + }, + gatewayProxy: &egv1a1.EnvoyProxy{ + Spec: egv1a1.EnvoyProxySpec{ + MergeType: new(egv1a1.StrategicMerge), + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{}, + }, + }, + }, + }, + expectedSpec: &egv1a1.EnvoyProxySpec{ + MergeType: new(egv1a1.StrategicMerge), + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{ + Name: new("edge-proxy"), + Container: &egv1a1.KubernetesContainerSpec{Image: new("mirror.example/envoy:dev")}, + }, + }, + }, + }, + }, } for _, tc := range testCases { @@ -398,3 +552,31 @@ func TestMergeEnvoyProxyConfigs(t *testing.T) { }) } } + +func TestMergeEnvoyProxyConfigsWorkloadKindDoesNotMutateDefault(t *testing.T) { + defaultSpec := &egv1a1.EnvoyProxySpec{ + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{Replicas: new(int32(2))}, + EnvoyHpa: &egv1a1.KubernetesHorizontalPodAutoscalerSpec{MaxReplicas: new(int32(5))}, + }, + }, + } + original := defaultSpec.DeepCopy() + gatewayClassProxy := &egv1a1.EnvoyProxy{ + Spec: egv1a1.EnvoyProxySpec{ + MergeType: new(egv1a1.StrategicMerge), + Provider: &egv1a1.EnvoyProxyProvider{ + Type: egv1a1.EnvoyProxyProviderTypeKubernetes, + Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{ + EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{}, + }, + }, + }, + } + + _, err := MergeEnvoyProxyConfigs(defaultSpec, gatewayClassProxy, nil) + require.NoError(t, err) + require.Empty(t, cmp.Diff(original, defaultSpec)) +} diff --git a/release-notes/current/bug_fixes/10101-envoyproxy-merge-workload-kind.md b/release-notes/current/bug_fixes/10101-envoyproxy-merge-workload-kind.md new file mode 100644 index 00000000000..790027ebede --- /dev/null +++ b/release-notes/current/bug_fixes/10101-envoyproxy-merge-workload-kind.md @@ -0,0 +1 @@ +Fixed a merged EnvoyProxy (with `mergeType` set) rendering both an Envoy Deployment and DaemonSet when it selects a different workload kind than a less specific configuration; the less specific workload is now converted to the selected kind, keeping its container, pod and name settings. diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index bbd83d7bbd1..79f366648b9 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -2532,7 +2532,7 @@ _Appears in:_ | `dynamicModules` | _[DynamicModuleEntry](#dynamicmoduleentry) array_ | false | | DynamicModules defines the set of dynamic modules that are allowed to be
used by EnvoyExtensionPolicy resources and dynamic module load balancer
policies. Each entry registers a module by a logical name and specifies
the shared library that Envoy will load.
The EnvoyProxy owner is responsible for ensuring the module .so files are available
on the proxy container's filesystem (e.g., via init containers, custom images,
or shared volumes). | | `wasmModules` | _[WasmModuleEntry](#wasmmoduleentry) array_ | false | | WasmModules defines the set of Wasm modules that are allowed to be used by
EnvoyExtensionPolicy resources. Each entry registers a module by a logical
name and a source (currently Local path).
When EnvoyExtensionPolicy.wasm[].code is omitted, wasm[].name is looked up
in this list.
The EnvoyProxy owner is responsible for ensuring Local modules are available
on the proxy container's filesystem (e.g., via init containers, custom images,
or shared volumes). EnvoyExtensionPolicy never carries a raw filesystem path. | | `geoIP` | _[EnvoyProxyGeoIP](#envoyproxygeoip)_ | false | | GeoIP defines shared GeoIP provider configuration for this EnvoyProxy fleet. | -| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType controls how this EnvoyProxy merges with less specific configurations
in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway).
If unset, this EnvoyProxy completely replaces less specific settings.
Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. | +| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType controls how this EnvoyProxy merges with less specific configurations
in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway).
If unset, this EnvoyProxy completely replaces less specific settings.
When merging, if this EnvoyProxy sets envoyDeployment or envoyDaemonSet and a less
specific configuration sets the other, the less specific workload is converted to
the selected kind: its container, pod and name settings are kept, and settings that
only apply to the previous kind (including its patch, and envoyHpa when switching
to envoyDaemonSet) are dropped.
Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. | #### EnvoyProxyStatus diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index 41b922b6651..eaf6b893414 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -37629,6 +37629,11 @@ spec: MergeType controls how this EnvoyProxy merges with less specific configurations in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway). If unset, this EnvoyProxy completely replaces less specific settings. + When merging, if this EnvoyProxy sets envoyDeployment or envoyDaemonSet and a less + specific configuration sets the other, the less specific workload is converted to + the selected kind: its container, pod and name settings are kept, and settings that + only apply to the previous kind (including its patch, and envoyHpa when switching + to envoyDaemonSet) are dropped. Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. enum: - Replace diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 9e288a5900b..50bc1bf7dea 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -13567,6 +13567,11 @@ spec: MergeType controls how this EnvoyProxy merges with less specific configurations in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway). If unset, this EnvoyProxy completely replaces less specific settings. + When merging, if this EnvoyProxy sets envoyDeployment or envoyDaemonSet and a less + specific configuration sets the other, the less specific workload is converted to + the selected kind: its container, pod and name settings are kept, and settings that + only apply to the previous kind (including its patch, and envoyHpa when switching + to envoyDaemonSet) are dropped. Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. enum: - Replace diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index 71752bbaf7f..7bdc186b319 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -13567,6 +13567,11 @@ spec: MergeType controls how this EnvoyProxy merges with less specific configurations in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway). If unset, this EnvoyProxy completely replaces less specific settings. + When merging, if this EnvoyProxy sets envoyDeployment or envoyDaemonSet and a less + specific configuration sets the other, the less specific workload is converted to + the selected kind: its container, pod and name settings are kept, and settings that + only apply to the previous kind (including its patch, and envoyHpa when switching + to envoyDaemonSet) are dropped. Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. enum: - Replace diff --git a/test/helm/gateway-helm/envoy-gateway-config-watch.out.yaml b/test/helm/gateway-helm/envoy-gateway-config-watch.out.yaml index 70337c3d2b2..d3efd93dc13 100644 --- a/test/helm/gateway-helm/envoy-gateway-config-watch.out.yaml +++ b/test/helm/gateway-helm/envoy-gateway-config-watch.out.yaml @@ -32,6 +32,13 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: docker.io/envoyproxy/envoy:distroless-dev + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/test/helm/gateway-helm/envoy-proxy-daemonset.out.yaml b/test/helm/gateway-helm/envoy-proxy-daemonset.out.yaml index dfc09737378..eb9e1daead8 100644 --- a/test/helm/gateway-helm/envoy-proxy-daemonset.out.yaml +++ b/test/helm/gateway-helm/envoy-proxy-daemonset.out.yaml @@ -471,6 +471,13 @@ spec: fieldRef: apiVersion: v1 fieldPath: metadata.namespace + - name: ENVOY_GATEWAY_SERVICE_ACCOUNT + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.serviceAccountName + - name: ENVOY_GATEWAY_FULLNAME + value: gateway-helm - name: KUBERNETES_CLUSTER_DOMAIN value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest diff --git a/test/helm/gateway-helm/envoy-proxy-image-disabled.out.yaml b/test/helm/gateway-helm/envoy-proxy-image-disabled.out.yaml index 3293d24fc72..f64a78fc4e2 100644 --- a/test/helm/gateway-helm/envoy-proxy-image-disabled.out.yaml +++ b/test/helm/gateway-helm/envoy-proxy-image-disabled.out.yaml @@ -461,6 +461,13 @@ spec: fieldRef: apiVersion: v1 fieldPath: metadata.namespace + - name: ENVOY_GATEWAY_SERVICE_ACCOUNT + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.serviceAccountName + - name: ENVOY_GATEWAY_FULLNAME + value: gateway-helm - name: KUBERNETES_CLUSTER_DOMAIN value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest diff --git a/test/helm/gateway-helm/envoy-proxy-inline-image.out.yaml b/test/helm/gateway-helm/envoy-proxy-inline-image.out.yaml index 9b497255f6c..c2f2df66d18 100644 --- a/test/helm/gateway-helm/envoy-proxy-inline-image.out.yaml +++ b/test/helm/gateway-helm/envoy-proxy-inline-image.out.yaml @@ -473,6 +473,13 @@ spec: fieldRef: apiVersion: v1 fieldPath: metadata.namespace + - name: ENVOY_GATEWAY_SERVICE_ACCOUNT + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.serviceAccountName + - name: ENVOY_GATEWAY_FULLNAME + value: gateway-helm - name: KUBERNETES_CLUSTER_DOMAIN value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest